CVE-2026-66702 describes an unauthenticated Cross Site Scripting (XSS) vulnerability in Rank Math SEO versions up to 1.0.274.1. This vulnerability allows remote attackers to inject and execute arbitrary scripts without requiring authentication. The CVSS 3.1 vector indicates the attack can be performed remotely with low attack complexity and no privileges required, but user interaction is needed. The impact includes partial confidentiality, integrity, and availability loss. No patch or vendor advisory details are currently available.

Successful exploitation could allow attackers to execute arbitrary scripts in the context of users visiting the affected application, potentially leading to theft of sensitive information, session hijacking, or other malicious actions. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access or applying web application firewall rules to detect and block XSS payloads targeting this plugin.